Cross-Site Scripting Vulnerability in Kubeflow Pipelines

CVE-2026-88986

What is CVE-2026-88986?

Kubeflow Pipelines, designed for building and deploying machine learning workflows, has a vulnerability that allows unauthenticated attackers to exploit frontend routes. This occurs due to untrusted values being included in HTML-capable error responses. When a user accesses a crafted link, JavaScript may execute in the user's browser, depending on deployment permissions. Potential cookie disclosure vulnerabilities involve cookie attributes, and while server-side code execution risks are not confirmed, this issue has been resolved in version 2.15.0, and users are advised to upgrade.

References